CVE-2026-14314: unknown peprodev woocommerce receipt uploader
Vulnerability summary
CVE-2026-14314 is a medium (CVSS 5.3) vulnerability in unknown peprodev woocommerce receipt uploader. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 06-08-2026PublishedVulnerability first disclosed.
- 06-08-2026Last modifiedVulnerability information updated.
Description
The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment receipts, that they do not own.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
+0.09 pp
From 0.24% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Affected systems
Unknown1 product
Wordpress1 product
- pepro-bacs-receipt-upload-for-woocommerce≤ 2.8.0
2 vendors · 2 products